Security Research · 6 September 2026
Investigating Crusader Worker 1.0: 91 IP Addresses, 20 Google Cloud Regions, and the Footprints of a Distributed Internet Scanner
A technical investigation based on 91 source IPs, 674 Fail2Ban matches, first-party telemetry, and independent public observations.
Executive Summary
ProfesyonelWeb observed a distributed scanning campaign using crusader-worker/1.0. At the 6 September 2026 snapshot, the dedicated pweb-crusader-worker-v1 jail recorded 674 matches and 91 banned source IPs. The first 90 addresses matched Google's official cloud.json customer-resource prefixes across 20 Google Cloud scopes. The 91st IP, 34.34.191.23, was captured later during the same live campaign and WHOIS identified Google LLC. We do not claim an independently verified region/scope for that 91st address in this publication.
What Is Crusader Worker 1.0?
The most defensible behavioral description is a distributed web exposure and vulnerability discovery scanner. Its operator and official project ownership remain unknown. We therefore do not attribute it to Google, Censys, Shodan, or any other organization without evidence.
User-Agent: crusader-worker/1.0. Current evidence does not establish whether this is the scanner's actual product/project name, an operator-selected worker label, or simply a scanning signature.Probe Family One: Secrets and Framework Exposure
Repeated paths include /.env, /env, WordPress configuration remnants, Laravel logs and Ignition endpoints, and Spring Boot Actuator paths. These are common places where secrets, backups, or diagnostic surfaces may be accidentally exposed.
Probe Family Two: Git Repository Exposure
Independent public logs also show broad /.git/config discovery across common deployment roots such as /api, /backend, /src, /app, /site, /wordpress, /htdocs, /var/www, /www, /public, and /html.
The Curious /crusader-404-probe
This custom path is one of the campaign's strongest behavioral identifiers. Its behavior is consistent with a control request used to learn a site's normal 404 or soft-404 response, but that remains a technical inference rather than a documented operator statement.
Burst Scanning
Multiple workers fired many distinct probes within the same second. That strongly supports automated parallel or asynchronous execution. A centralized controller, queue, or serverless scheduler would be plausible architecture, but is not proven.
Google Cloud Distribution — First 90 IPs
Official Google Cloud prefix matching returned 90/90 matches for the first cohort. 62 addresses were in US scopes (68.9%); 28 were outside the US.
| Google Cloud scope | IP count |
|---|---|
us-east1 | 21 |
us-central1 | 18 |
us-east4 | 11 |
us-west1 | 5 |
europe-west3 | 4 |
us-west3 | 4 |
europe-west4 | 3 |
us-west2 | 3 |
asia-northeast3 | 3 |
europe-west1 | 3 |
europe-southwest1 | 3 |
asia-southeast2 | 3 |
southamerica-east1 | 2 |
asia-south1 | 1 |
asia-southeast1 | 1 |
europe-west6 | 1 |
europe-north1 | 1 |
northamerica-northeast1 | 1 |
asia-east2 | 1 |
australia-southeast1 | 1 |
Network Fingerprints
Two independent Crusader observations on ELLIO shared the same User-Agent, overlapping probe vocabulary, and identical TCP/MuonFP value 65320:2-4-8-1-3:1420:10. One of them, 35.236.75.211, also exposed JA4 t13i1010h1_61a7ad8aa9b6_3a8073edd8ef. We do not generalize that JA4 to the full fleet.
Evidence / Inference / Unknown
ESTABLISHED
91 source IPs in the Crusader jail; consistent crusader-worker/1.0 User-Agent; repeated sensitive-path probes; first 90 matched official Google Cloud ranges.
STRONG BEHAVIORAL FINDING
Same-second bursts, repeated task sequences across workers, and the custom 404 probe are consistent with coordinated automation.
UNKNOWN
Operator identity, official project ownership, controller architecture, and whether the full fleet shares one TLS fingerprint.
ProfesyonelWeb First-Party IOC Dataset — 6 September 2026
The following 91 addresses were captured by the dedicated pweb-crusader-worker-v1 jail in our infrastructure. They are network IOCs, not identities of people or organizations.
crusader-worker/1.0 in the 6 September 2026 research snapshot. IP addresses in cloud infrastructure may be reassigned over time; this dataset should therefore not be treated as a permanent or indefinite blocklist. Future blocking decisions should be revalidated against current User-Agent data, request behavior, targeted paths, timing correlation, and other telemetry.| Source IP | Signature | Source |
|---|---|---|
34.73.126.230 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.159.204.144 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.26.203.248 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
35.188.94.210 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.85.179.64 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.59.21.111 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
104.198.56.247 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.24.59.51 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
35.188.7.174 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.171.230.203 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.70.161.3 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.63.245.57 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
35.237.69.213 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
35.185.73.65 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
35.245.146.204 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
8.34.219.127 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.12.8.212 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
136.114.140.138 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.138.81.27 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.42.49.156 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.24.165.179 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.20.225.161 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.47.99.51 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.182.153.4 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
136.70.92.192 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
136.70.64.27 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.148.223.6 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.20.168.239 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
8.231.78.19 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.23.241.158 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
8.234.239.54 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.48.118.123 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
35.243.136.237 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.86.81.18 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.138.148.25 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.79.114.166 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
8.228.241.247 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
35.230.115.27 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
136.85.72.46 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.65.122.177 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
35.196.69.53 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.88.75.40 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.44.113.134 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.106.72.61 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
35.229.18.104 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.185.231.221 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.75.27.14 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.26.183.3 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.41.241.201 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
136.118.193.212 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
104.196.1.67 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
35.234.122.138 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.74.13.50 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.118.173.99 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.175.253.53 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.52.218.172 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.175.91.18 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.44.189.55 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
35.203.143.148 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.90.212.195 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
35.220.159.6 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.39.214.130 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.32.163.117 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.171.193.51 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.106.38.212 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
35.188.33.158 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.50.105.82 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.55.254.111 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.186.144.127 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.175.183.75 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.148.10.27 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.101.232.28 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
8.234.161.192 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
104.196.17.155 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
35.244.69.211 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.64.99.234 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
35.255.237.118 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.106.91.172 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.14.111.10 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.185.239.175 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.47.82.185 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.128.82.22 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.95.228.141 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.11.183.85 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.74.93.223 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
35.190.179.122 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.45.252.177 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.48.88.185 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.145.72.43 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.21.67.240 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
34.34.191.23 | crusader-worker/1.0 | ProfesyonelWeb first-party telemetry |
Defending Against Similar Scanners
The primary defense is to ensure a scanner has nothing valuable to retrieve: secrets, backup configuration files, repository metadata, debug endpoints and actuator endpoints should not be publicly accessible. Fail2Ban, Nginx deny rules and WAF controls are secondary layers. Behind Cloudflare, origin-only iptables rules may not be sufficient; a real-client-IP-aware Nginx or WAF layer is important.
Independent Public Observations
- ELLIO — 35.236.75.211
- ELLIO — 35.234.190.55
- Independent WordPress.org log report
- SK Wong SiteTraffic
- 0z9 independent web logs
Conclusion
Crusader Worker 1.0 behaves like a standardized, automated and distributed web exposure/vulnerability discovery scanner. We do not know who operates it. This research will be updated if new probe families, new fingerprints, or credible attribution evidence emerge.
Research note: IP count is not VM count. Google Cloud network space does not imply Google attribution. HTTP 200 alone does not prove a sensitive resource is exposed because soft-404 and fallback routing must be considered.